Now Google Chrome warns if your browser has been hijacked

Chrome browser hijackBrowser hijacking is a big problem.

I’ve lost count of the number of times that friends and family have asked me to take a look at their PC “because it’s acting funny”, only to discover that their browser has been meddled with by something like Babylon Toolbar, CoolWebSearch or Conduit Search.

Browser-hijacking software like these are often bundled with third-party applications, and can be installed at the same time if the user isn’t careful, changing your browser’s homepage, displaying irritating hard-to-remove pop-up adverts, or redirecting search queries and displaying sponsored links all with the intention of earning more revenue for the people behind them.

And, as if that weren’t irritating enough, browser hijacking toolbars and add-ons are often very complicated to permanently remove from a Windows computer – even modern anti-virus software often struggles to fix the problem, leaving victims to either download specific clean-up tools or follow complicated step-by-step procedures published on internet forums.

So I was pleased to read the latest blog post from the Google Chrome team, who explained that Chrome would be “prompting Windows users whose settings appear to have been changed if they’d like to restore their browser settings back to factory default.”

Chrome hijack detected

Reset altered Chrome settings?

Chrome detected that your browser settings may have been changed without your knowledge. Would you like to reset them to their original defaults?

According to Google, Chrome should notice that your browser’s settings have been changed – and give you an easy way (thankfully it’s the default) to reset them if the alteration wasn’t authorised by you.

Of course, resetting your browser settings does mean that it will lose other changes you might have made:

Note that this will disable any extensions, apps and themes you have installed. If you’d like to reactivate any of your extensions after the reset, you can find and re-enable them by looking in the Chrome menu under “More tools > Extensions.” Apps are automatically re-enabled the next time you use them.

Finally, resetting your browser’s settings does not necessarily mean that you have succeeded in removing the adware which messed with your settings in the first place – these typically survive rebooting, and the hijack could occur again.

But at least Google is doing something to make life a little harder for the browser hijackers, and perhaps more members of my family and circle of friends will realise that something strange is going on with their browser.

Features like this, combined with users remembering to follow best practices, being careful about what they install and keeping their anti-virus software and security patches updated, help make the internet that little bit more of a safer place.

Tags: , , , , , , , , , ,


, , , , , , , , , ,

3 Responses

  1. Steve Lyons 2 February 4, 2014 at 12:15 pm #

    Noticed this the other day when trying to remove one of these browser hijackers from no.3 sons PC. Chose not to reset to factory defaults, only wanted to put home page back to Google for him (after jumping through all the various hoops to remove the crapware!).

  2. Andrew Mitchell 2 February 4, 2014 at 8:06 pm #

    Any thoughts on how likely this feature would be to trigger a false positive?

    • Graham Cluley
      Graham Cluley 50 February 4, 2014 at 8:24 pm #

      I think that rather depends on what you think the Google message is saying.

      It says "Chrome detected that your browser settings may have been changed without your knowledge." It's not saying that whatever changed your settings is necessarily malicious and – of course – it's possible you *did* know that a particular piece of software was going to tweak your browser settings.

      I'm sure that there will be occasions when Chrome will display the warning when users have not had their browser hijacked, but – even so – I'm sure that in balance it is likely to be more helpful than harmful.

Leave a Reply